RE: [fw-wiz] PIX -> ISA -> OWA Configuration - Firewalls

This is a discussion on RE: [fw-wiz] PIX -> ISA -> OWA Configuration - Firewalls ; I hate to disagree but in 1 the [hackable box] is the ISA Proxy which is
'protected' by the outer PIX. The 'pot-o-gold' as you put it is behind the
second PIX. Access to the internal network for this box ...

RE: [fw-wiz] PIX -> ISA -> OWA Configuration

I hate to disagree but in 1 the [hackable box] is the ISA Proxy which is
'protected' by the outer PIX. The 'pot-o-gold' as you put it is behind the
second PIX. Access to the internal network for this box is very limited to
only port 443.

IN 2 you have out two MS boxes 'out there' for the Hackers to get to and as
Paul points out, having the [OWA] Server out there 'forces' you to open many
ports so that Active Directory can function.

I've tried it both ways and I strongly agreed with Paul AND 9unfortunaly in
this case) Microsoft 2 is a 'bad' choice due simply to the un-needed
exposure of the additional ports by putting the [OWA] in the 'DMZ'.

Once again proving that while MS have made a lot of progress in security
some of their authors still have no idea what they are doing. The problem is
that people get too excited about their architecture diagrams.

I always internally parse these diagrams as:

[spaghetti] --> [hackable box] --> [pot of gold]

In 1) there are no controls at all between the hackable box and the pot of
gold. In 2) there is.

Once you simplify things the choice becomes obvious.

But hey, you could throw another firewall into 2) if you want. And maybe an
IPS as well. A red one, even.